CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 47)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
YITH WooCommerce Wishlist
≤4.18.1Update to 4.19.0
- High7.5Authenticated (Contributor+) PHP Object Injection
Team Members – Team Showcase, Team Slider, Grid, Table & Staff Directory
≤2.8.2Update to 2.8.3
- High7.5Authenticated (Contributor+) PHP Object Injection
GS Pinterest Portfolio – Pinterest Feed, Pinterest Board & Pin Widgets
≤1.9.2Update to 1.9.3
- Medium6.1Reflected Cross-Site Scripting
Live Summary for Gravity Forms
≤1.2.10Update to 1.2.11
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.5Update to 3.15.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Strong Testimonials
≤3.3.12Update to 3.3.13
- Medium5.3Unauthenticated Information Exposure
WholesaleX – Wholesale Pricing & B2B Solution
≤3.0.8Update to 3.0.9
- High8.8Authenticated (Subscriber+) Arbitrary PHP Code Execution
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.5Update to 6.2.0
- Medium5.3Unauthenticated Abandoned Cart Takeover
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails
<2.2.0Update to 2.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Jane Menu
≤1.5.0Update to 1.5.1
- Medium5.8Unauthenticated HTML Injection
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
<1.26.15Update to 1.26.15
- Medium4.3Missing Authorization
Sensei LMS – Online Courses, Quizzes, & Learning
≤4.26.3Update to 4.26.4
- Medium5.3Missing Authorization
SUMIT Payment Gateway for WooCommerce
<4.0.0Update to 4.0.0
- Medium5.3Unauthenticated Account Activation Bypass
WholesaleX – Wholesale Pricing & B2B Solution
<3.0.9Update to 3.0.9
- Medium5.3Unauthenticated Information Exposure
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.4Update to 4.9.5
- Medium5.3Unauthenticated Insecure Direct Object Reference
SmartyParcel Shipping – DHL Express, GLS, InPost & Nova Post for WooCommerce
≤1.23.3Update to 1.23.4
- Medium4.3Missing Authorization
Backup and Staging by WP Time Capsule
≤1.22.27Update to 1.22.28
- High8.8Cross-Site Request Forgery
Uncanny Toolkit for LearnDash
<3.8.2Update to 3.8.2
- Medium5.31.1.2 - Unauthenticated Information Exposure
Click n Chat (Chat Widget Integration)
1.0.4 – 1.1.2Update to 1.1.3
- High7.51.1.2 - Unauthenticated SQL Injection
Click n Chat (Chat Widget Integration)
1.0.4 – 1.1.2Update to 1.1.3
- High7.5Unauthenticated SQL Injection
Click n Chat (Chat Widget Integration)
≤1.1.2Update to 1.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Translate WordPress with Weglot 2.0 – Multilingual AI Translation
≤6.4.2Update to 6.4.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.4Update to 4.3.5
- Medium5.3Missing Authorization
TI WooCommerce Wishlist
≤2.12.0Update to 2.13.0
- High7.32.9.25 - Unauthenticated Privilege Escalation
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
2.9.21 – 2.9.25Update to 2.9.26
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Pricing Table WordPress Plugin – Easy Pricing Tables
≤4.1.2Update to 4.1.3
- Low2.7Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.8.5Update to 3.8.6
- Medium4.3Missing Authorization
SmartyParcel Shipping – DHL Express, GLS, InPost & Nova Post for WooCommerce
≤1.23.3Update to 1.23.4
- Medium5.3Missing Authorization
Booking Package
≤1.7.30Update to 1.7.31
- Medium5.3Missing Authorization
Escape Room Booking Pro
≤1.3.0Update to 1.3.1